Clickjacking Protection in Web Channel Experience Management (WCEM), SAP security note 2244161

SAP security note 2244161, “Clickjacking Protection in Web Channel Experience Management (WCEM)”. Below are the symptom and SAP recommended solution.

Description

Symptom

Application in WebChannelExperienceManagement (WCEM) is not protected against Clickjacking attacks.

Solution

This SAP Note provides the solution for WebChannelExperienceManagement (WCEM). Since WCEM is not intended to be used within frames, the ‘Frame Busting’ approach is selected. This solution and its activation differ from the Clickjacking Framing solution described in SAP Note 2319727.

To ensure the WCEM application continues to function correctly after applying this note, Clickjacking protection must be explicitly activated.

If you prefer not to implement a specific solution for your site, SAP recommends evaluating SAP Note 2042819, which describes how to modify HTTP headers, and SAP Note 1781171, under the assumption that WCEM is not released to be used in frames.

Reason and prerequisites

Clickjacking is a UI-redressing attack where an attacker tricks a user into clicking on something different than what the user perceives. This attack leverages standard HTML functionalities and does not exploit weaknesses in the application’s code. Further details can be found at OWASP Clickjacking.

References

• SAP Note 2319727 – Clickjacking protection framework in SAP Netweaver AS ABAP and AS Java
• SAP Note 2042819 – ICM – HTTP Response Header Rewriting
• SAP Note 1781171 – ClickJacking vulnerability in WebDynpro Java